Google Chrome CVE-2026-84354

Requires the victim to open a crafted HTML page in a vulnerable Chrome desktop build (< 152.0.7977.75) - the CVSS UI:R and the description's explicit 'leveraging social engineering' confirm user interaction (navigating to attacker content) is mandatory, which is the primary limiting factor. No authentication and no special browser configuration are needed (PR:N, default settings), and delivery is fully remote over the network (AV:N). Exploitation is limited to desktop Chrome versions before the 152.0.7977.75 fix; it is not zero-click and does not work against already-patched or non-vulnerable builds.

This is a genuine high-priority patch, not a paper tiger: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes an unauthenticated, low-complexity, network-delivered sandbox escape with full C/I/A impact, gated only by a single user action (visiting a page). The one real limiter is UI:R - the victim must be socially engineered into loading attacker content - so this is not wormable/zero-click, which typically keeps EPSS modest for browser bugs shortly after disclosure. No EPSS score, KEV listing, or public POC is present in the provided data, so current in-the-wild risk is inferred rather than confirmed. Browser sandbox escapes are historically high-value targets that attackers and exploit brokers weaponize once details surface, so patching should be treated as urgent even without a KEV entry - any organization running Chrome at scale, from a large enterprise fleet down to a mid-sized municipal IT team in opole, should roll the update promptly. Note the input tag 'Authentication Bypass' is inaccurate: CWE-863 is an authorization (sandbox-boundary) defect, not an authentication bypass - do not let the mislabel skew triage.

An attacker crafts a malicious HTML page and uses phishing or a malvertising link to convince a victim to open it in a vulnerable Chrome build. When the page loads, it abuses the FileSystem authorization flaw to escape the renderer sandbox and execute attacker-controlled code with browser-level privileges on the victim's machine. No public POC is identified yet, but the low attack complexity and network vector make reliable exploitation plausible once technical details circulate.